summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat
-rw-r--r--epistemia/systems/demiurge.scm4
-rw-r--r--epistemia/systems/hastur.scm408
2 files changed, 206 insertions, 206 deletions
diff --git a/epistemia/systems/demiurge.scm b/epistemia/systems/demiurge.scm
index 93488fd..d7c0792 100644
--- a/epistemia/systems/demiurge.scm
+++ b/epistemia/systems/demiurge.scm
@@ -147,8 +147,8 @@
147 (one-shot? #t) 147 (one-shot? #t)
148 (documentation "Set GPU power cap on boot") 148 (documentation "Set GPU power cap on boot")
149 (start #~(make-forkexec-constructor 149 (start #~(make-forkexec-constructor
150 (list #$(file-append bash "/bin/bash") "-c" 150 (list #$(file-append bash "/bin/bash") "-c"
151 (string-append 151 (string-append
152 "echo 294000000 > /sys/class/drm/card0/device/hwmon/hwmon*/power1_cap; " 152 "echo 294000000 > /sys/class/drm/card0/device/hwmon/hwmon*/power1_cap; "
153 "echo 294000000 > /sys/class/drm/card1/device/hwmon/hwmon*/power1_cap")))) 153 "echo 294000000 > /sys/class/drm/card1/device/hwmon/hwmon*/power1_cap"))))
154 (stop #~(make-kill-destructor))))) 154 (stop #~(make-kill-destructor)))))
diff --git a/epistemia/systems/hastur.scm b/epistemia/systems/hastur.scm
index 1451e54..2153f1f 100644
--- a/epistemia/systems/hastur.scm
+++ b/epistemia/systems/hastur.scm
@@ -33,215 +33,215 @@
33 #:use-module (epistemia packages zfs)) 33 #:use-module (epistemia packages zfs))
34 34
35(operating-system 35(operating-system
36 (inherit base-system) 36 (inherit base-system)
37 (host-name "hastur.epistemia") 37 (host-name "hastur.epistemia")
38 38
39 (users (cons (user-account 39 (users (cons (user-account
40 (name "vin") 40 (name "vin")
41 (comment "Vineet") 41 (comment "Vineet")
42 (shell (file-append bash "/bin/bash")) 42 (shell (file-append bash "/bin/bash"))
43 (group "users") 43 (group "users")
44 (supplementary-groups '("wheel" "audio" "video" "input" "seat" "tty" "kvm"))) 44 (supplementary-groups '("wheel" "audio" "video" "input" "seat" "tty" "kvm")))
45 %base-user-accounts)) 45 %base-user-accounts))
46 46
47 (kernel linux-6.18) 47 (kernel linux-6.18)
48 (kernel-arguments (list "net.ifnames=0" "modprobe.blacklist=snd_hda_intel")) 48 (kernel-arguments (list "net.ifnames=0" "modprobe.blacklist=snd_hda_intel"))
49 (kernel-loadable-modules (list (list zfs-linux "module"))) 49 (kernel-loadable-modules (list (list zfs-linux "module")))
50 50
51 (initrd (lambda (file-systems . args) 51 (initrd (lambda (file-systems . args)
52 (apply microcode-initrd file-systems 52 (apply microcode-initrd file-systems
53 #:initrd epistemia-zfs-initrd 53 #:initrd epistemia-zfs-initrd
54 #:zfs-package zfs-linux 54 #:zfs-package zfs-linux
55 args))) 55 args)))
56 (firmware (cons* i915-firmware iwlwifi-firmware %base-firmware)) 56 (firmware (cons* i915-firmware iwlwifi-firmware %base-firmware))
57 57
58 (bootloader (bootloader-configuration 58 (bootloader (bootloader-configuration
59 (bootloader grub-zfs) 59 (bootloader grub-zfs)
60 (targets '("/boot/efi")))) 60 (targets '("/boot/efi"))))
61 61
62 (file-systems (append 62 (file-systems (append
63 (list (file-system 63 (list (file-system
64 (device "zroot/root") 64 (device "zroot/root")
65 (mount-point "/") 65 (mount-point "/")
66 (type "zfs") 66 (type "zfs")
67 (check? #f) 67 (check? #f)
68 (needed-for-boot? #t)) 68 (needed-for-boot? #t))
69 (file-system 69 (file-system
70 (device "zroot/gnu") 70 (device "zroot/gnu")
71 (mount-point "/gnu") 71 (mount-point "/gnu")
72 (type "zfs") 72 (type "zfs")
73 (check? #f) 73 (check? #f)
74 (needed-for-boot? #t)) 74 (needed-for-boot? #t))
75 (file-system 75 (file-system
76 (device "zroot/var") 76 (device "zroot/var")
77 (mount-point "/var") 77 (mount-point "/var")
78 (type "zfs") 78 (type "zfs")
79 (check? #f) 79 (check? #f)
80 (needed-for-boot? #t)) 80 (needed-for-boot? #t))
81 (file-system 81 (file-system
82 (device "zroot/home") 82 (device "zroot/home")
83 (mount-point "/home") 83 (mount-point "/home")
84 (type "zfs") 84 (type "zfs")
85 (check? #f) 85 (check? #f)
86 (needed-for-boot? #t)) 86 (needed-for-boot? #t))
87 (file-system 87 (file-system
88 (device (uuid "85DD-DE6D" 'fat)) 88 (device (uuid "85DD-DE6D" 'fat))
89 (mount-point "/boot/efi") 89 (mount-point "/boot/efi")
90 (type "vfat")) 90 (type "vfat"))
91 (file-system 91 (file-system
92 (device "none") 92 (device "none")
93 (mount-point "/home/vin/.local/state/runtime") 93 (mount-point "/home/vin/.local/state/runtime")
94 (type "tmpfs") 94 (type "tmpfs")
95 (options "uid=1000"))) 95 (options "uid=1000")))
96 %base-file-systems)) 96 %base-file-systems))
97 97
98 (swap-devices (list (swap-space (target (uuid "a9f91237-58fe-452a-b4af-cbd281f5b8ce"))))) 98 (swap-devices (list (swap-space (target (uuid "a9f91237-58fe-452a-b4af-cbd281f5b8ce")))))
99 99
100 (packages (append (list emacs-no-x 100 (packages (append (list emacs-no-x
101 git 101 git
102 zfs-linux) 102 zfs-linux)
103 %base-packages)) 103 %base-packages))
104 104
105 (services (modify-services (append (list (service age-secret-service-type 105 (services (modify-services (append (list (service age-secret-service-type
106 (age-secret-configuration 106 (age-secret-configuration
107 (secrets (list 107 (secrets (list
108 (age-secret 108 (age-secret
109 (name "wpa_supplicant") 109 (name "wpa_supplicant")
110 (file (local-file "../secrets/wpa_supplicant.age"))) 110 (file (local-file "../secrets/wpa_supplicant.age")))
111 (age-secret 111 (age-secret
112 (name "wg0_hastur") 112 (name "wg0_hastur")
113 (file (local-file "../secrets/wg0_hastur.age"))) 113 (file (local-file "../secrets/wg0_hastur.age")))
114 (age-secret 114 (age-secret
115 (name "wg1_hastur") 115 (name "wg1_hastur")
116 (file (local-file "../secrets/wg1_hastur.age"))) 116 (file (local-file "../secrets/wg1_hastur.age")))
117 (age-secret 117 (age-secret
118 (name "wg2_hastur") 118 (name "wg2_hastur")
119 (file (local-file "../secrets/wg2_hastur.age"))))))) 119 (file (local-file "../secrets/wg2_hastur.age")))))))
120 (simple-service 'zfs-loader 120 (simple-service 'zfs-loader
121 kernel-module-loader-service-type 121 kernel-module-loader-service-type
122 '("zfs")) 122 '("zfs"))
123 (simple-service 'zfs-shepherd-services 123 (simple-service 'zfs-shepherd-services
124 shepherd-root-service-type 124 shepherd-root-service-type
125 zfs-shepherd-services) 125 zfs-shepherd-services)
126 (simple-service 'zfs-shepherd-services-user-processes 126 (simple-service 'zfs-shepherd-services-user-processes
127 user-processes-service-type 127 user-processes-service-type
128 '(zfs-automount)) 128 '(zfs-automount))
129 (service seatd-service-type) 129 (service seatd-service-type)
130 (service iptables-service-type) 130 (service iptables-service-type)
131 (service unbound-service-type 131 (service unbound-service-type
132 (unbound-configuration 132 (unbound-configuration
133 (server 133 (server
134 (unbound-server 134 (unbound-server
135 (interface '("::1")) 135 (interface '("::1"))
136 (hide-version #t) 136 (hide-version #t)
137 (hide-identity #t) 137 (hide-identity #t)
138 (extra-options '((ip-freebind . yes) 138 (extra-options '((ip-freebind . yes)
139 (aggressive-nsec . no))))) 139 (aggressive-nsec . no)))))
140 (forward-zone 140 (forward-zone
141 (list 141 (list
142 (unbound-zone 142 (unbound-zone
143 (name ".") 143 (name ".")
144 (forward-addr '("10.0.13.1"))) 144 (forward-addr '("10.0.13.1")))
145 (unbound-zone 145 (unbound-zone
146 (name "carcosa.13f0.net.") 146 (name "carcosa.13f0.net.")
147 (forward-addr '("9.9.9.9"))))))) 147 (forward-addr '("9.9.9.9")))))))
148 (service dhcpcd-service-type 148 (service dhcpcd-service-type
149 (dhcpcd-configuration 149 (dhcpcd-configuration
150 (option '("rapid_commit" "interface_mtu")) 150 (option '("rapid_commit" "interface_mtu"))
151 (no-option '("nd_rdnss" 151 (no-option '("nd_rdnss"
152 "dhcp6_name_servers" 152 "dhcp6_name_servers"
153 "domain_name_servers" 153 "domain_name_servers"
154 "domain_name" 154 "domain_name"
155 "domain_search")) 155 "domain_search"))
156 (static '("domain_name_servers=::1" 156 (static '("domain_name_servers=::1"
157 "domain_search=epistemia")) 157 "domain_search=epistemia"))
158 (no-hook '("hostname")))) 158 (no-hook '("hostname"))))
159 (service wpa-supplicant-service-type 159 (service wpa-supplicant-service-type
160 (wpa-supplicant-configuration 160 (wpa-supplicant-configuration
161 (shepherd-requirement '(age-secret kernel-module-loader)) 161 (shepherd-requirement '(age-secret kernel-module-loader))
162 (wpa-supplicant wpa-supplicant-minimal) 162 (wpa-supplicant wpa-supplicant-minimal)
163 (dbus? #f) 163 (dbus? #f)
164 (interface "wlan0") 164 (interface "wlan0")
165 (config-file "/run/secrets/wpa_supplicant"))) 165 (config-file "/run/secrets/wpa_supplicant")))
166 (service bluetooth-service-type) 166 (service bluetooth-service-type)
167 (service openssh-service-type 167 (service openssh-service-type
168 (openssh-configuration 168 (openssh-configuration
169 (permit-root-login #f) 169 (permit-root-login #f)
170 (authorized-keys 170 (authorized-keys
171 `(("vin" ,(local-file "/data/ssh/id_ed25519.pub")) 171 `(("vin" ,(local-file "/data/ssh/id_ed25519.pub"))
172 ("root" ,(local-file "/data/ssh/id_ed25519.pub")))))) 172 ("root" ,(local-file "/data/ssh/id_ed25519.pub"))))))
173 (service wireguard-service-type 173 (service wireguard-service-type
174 (wireguard-configuration 174 (wireguard-configuration
175 (interface "wg0") 175 (interface "wg0")
176 (addresses '("172.27.194.145/32" "fd00:0000:1337:cafe:1111:1111:9893:6822/128")) 176 (addresses '("172.27.194.145/32" "fd00:0000:1337:cafe:1111:1111:9893:6822/128"))
177 (port 51821) 177 (port 51821)
178 (bootstrap-private-key? #f) 178 (bootstrap-private-key? #f)
179 (shepherd-requirement '(age-secret wpa-supplicant)) 179 (shepherd-requirement '(age-secret wpa-supplicant))
180 (private-key "/run/secrets/wg0_hastur") 180 (private-key "/run/secrets/wg0_hastur")
181 (pre-up '("while [ ! -f /run/secrets/wg0_hastur ]; do sleep 1; done" 181 (pre-up '("while [ ! -f /run/secrets/wg0_hastur ]; do sleep 1; done"
182 "while [ -z \"$(ip route show default)\" ]; do sleep 1; done" 182 "while [ -z \"$(ip route show default)\" ]; do sleep 1; done"
183 "ip route add 185.157.162.7 via $(ip route show default | cut -d' ' -f3) dev wlan0")) 183 "ip route add 185.157.162.7 via $(ip route show default | cut -d' ' -f3) dev wlan0"))
184 (post-down '("ip route del 185.157.162.7")) 184 (post-down '("ip route del 185.157.162.7"))
185 (peers 185 (peers
186 (list 186 (list
187 (wireguard-peer 187 (wireguard-peer
188 (name "ovpn-ams-29") 188 (name "ovpn-ams-29")
189 (public-key "wTlz3u1egzUrx4Ho02cL7Ht1BBa/C8bULzXStn5f+zk=") 189 (public-key "wTlz3u1egzUrx4Ho02cL7Ht1BBa/C8bULzXStn5f+zk=")
190 (allowed-ips '("0.0.0.0/0" "::0/0")) 190 (allowed-ips '("0.0.0.0/0" "::0/0"))
191 (endpoint "185.157.162.7:9929")))))) 191 (endpoint "185.157.162.7:9929"))))))
192 (service wireguard-service-type 192 (service wireguard-service-type
193 (wireguard-configuration 193 (wireguard-configuration
194 (interface "wg1") 194 (interface "wg1")
195 (addresses '("10.0.13.3/24" "fd00:b0ba:cafe:babe::3/64")) 195 (addresses '("10.0.13.3/24" "fd00:b0ba:cafe:babe::3/64"))
196 (port 51820) 196 (port 51820)
197 (bootstrap-private-key? #f) 197 (bootstrap-private-key? #f)
198 (private-key "/run/secrets/wg1_hastur") 198 (private-key "/run/secrets/wg1_hastur")
199 (table #f) 199 (table #f)
200 (shepherd-requirement '(age-secret unbound wpa-supplicant)) 200 (shepherd-requirement '(age-secret unbound wpa-supplicant))
201 (pre-up '("while [ ! -f /run/secrets/wg1_hastur ]; do sleep 1; done" 201 (pre-up '("while [ ! -f /run/secrets/wg1_hastur ]; do sleep 1; done"
202 "while [ -z \"$(ip route show default)\" ]; do sleep 1; done")) 202 "while [ -z \"$(ip route show default)\" ]; do sleep 1; done"))
203 (peers 203 (peers
204 (list 204 (list
205 (wireguard-peer 205 (wireguard-peer
206 (name "saklas.epistemia") 206 (name "saklas.epistemia")
207 (public-key "XvRailvccuc7LJIF4aaYM/MLkU4upiprwFlCfBllhl0=") 207 (public-key "XvRailvccuc7LJIF4aaYM/MLkU4upiprwFlCfBllhl0=")
208 (allowed-ips '("10.0.13.1/32" "fd00:b0ba:cafe:babe::1/128")) 208 (allowed-ips '("10.0.13.1/32" "fd00:b0ba:cafe:babe::1/128"))
209 (endpoint "141.95.52.111:51820") 209 (endpoint "141.95.52.111:51820")
210 (keep-alive 25)) 210 (keep-alive 25))
211 (wireguard-peer 211 (wireguard-peer
212 (name "demiurge.epistemia") 212 (name "demiurge.epistemia")
213 (public-key "FMLvbSxY6vA8CRV4S1vl4+pMeCr/kR9n0G5w9buNqh4=") 213 (public-key "FMLvbSxY6vA8CRV4S1vl4+pMeCr/kR9n0G5w9buNqh4=")
214 (allowed-ips '("10.0.13.2/32" "fd00:b0ba:cafe:babe::2/128")) 214 (allowed-ips '("10.0.13.2/32" "fd00:b0ba:cafe:babe::2/128"))
215 (endpoint "carcosa.13f0.net:51820") 215 (endpoint "carcosa.13f0.net:51820")
216 (keep-alive 25)))))) 216 (keep-alive 25))))))
217 (service wireguard-service-type 217 (service wireguard-service-type
218 (wireguard-configuration 218 (wireguard-configuration
219 (interface "wg2") 219 (interface "wg2")
220 (addresses '("10.0.14.2/24")) 220 (addresses '("10.0.14.2/24"))
221 (port 51822) 221 (port 51822)
222 (bootstrap-private-key? #f) 222 (bootstrap-private-key? #f)
223 (private-key "/run/secrets/wg2_hastur") 223 (private-key "/run/secrets/wg2_hastur")
224 (shepherd-requirement '(age-secret wpa-supplicant)) 224 (shepherd-requirement '(age-secret wpa-supplicant))
225 (pre-up '("while [ ! -f /run/secrets/wg2_hastur ]; do sleep 1; done" 225 (pre-up '("while [ ! -f /run/secrets/wg2_hastur ]; do sleep 1; done"
226 "while [ -z \"$(ip route show default)\" ]; do sleep 1; done")) 226 "while [ -z \"$(ip route show default)\" ]; do sleep 1; done"))
227 (peers 227 (peers
228 (list 228 (list
229 (wireguard-peer 229 (wireguard-peer
230 (name "abatur.epistemia") 230 (name "abatur.epistemia")
231 (public-key "OOpc1K4S56FdJkCaqHx3DC4aIO+zQCAo8ACwCboLEjg=") 231 (public-key "OOpc1K4S56FdJkCaqHx3DC4aIO+zQCAo8ACwCboLEjg=")
232 (allowed-ips '("10.0.14.1/32" "100.64.0.0/10")) 232 (allowed-ips '("10.0.14.1/32" "100.64.0.0/10"))
233 (endpoint "87.99.141.145:51822") 233 (endpoint "87.99.141.145:51822")
234 (keep-alive 25)))))) 234 (keep-alive 25))))))
235 (service pam-limits-service-type 235 (service pam-limits-service-type
236 (list (pam-limits-entry "@audio" 'both 'rtprio 99) 236 (list (pam-limits-entry "@audio" 'both 'rtprio 99)
237 (pam-limits-entry "@audio" 'both 'memlock 'unlimited))) 237 (pam-limits-entry "@audio" 'both 'memlock 'unlimited)))
238 (service powertop-service-type) 238 (service powertop-service-type)
239 (service tlp-service-type)) 239 (service tlp-service-type))
240 %base-services) 240 %base-services)
241 (sysctl-service-type config => 241 (sysctl-service-type config =>
242 (sysctl-configuration 242 (sysctl-configuration
243 (settings 243 (settings
244 (append 244 (append
245 '(("net.ipv4.ip_forward" . "1") 245 '(("net.ipv4.ip_forward" . "1")
246 ("net.ipv6.conf.all.forwarding" . "1")) 246 ("net.ipv6.conf.all.forwarding" . "1"))
247 %default-sysctl-settings))))))) 247 %default-sysctl-settings)))))))
generated by cgit v1.2.3 (git 2.25.1) at 2026-09-03 05:16:43 +0000